generate-native-extension

Write:

• .gitignore — emit exactly the following entries:

  • Node: node_modules/, dist/, build/
  • .ppmplugin build staging — MANDATORY: ppmplugin/ (the gitignored staging dir where /generate-ppmplugin writes the staged copy of the manifest, the binaries, and the final bundle — never committed. NOTE: the committed source-of-truth manifest.json lives at the repo root (./manifest.json, written below), NOT under ppmplugin/ — do not gitignore it; see shared/ppmplugin-format.md §1)
  • OS / editor: .DS_Store, .idea/, .vscode/
  • Claude Code local state (per-user, not shared): .claude/
  • Env: .env* (but allow !.env.example)
  • iOS build: Pods/, *.xcworkspace, DerivedData/, *.xcodeproj/xcuserdata/
  • Android build: *.iml, .gradle/, local.properties, captures/, .externalNativeBuild/, .cxx/
  • PCF build dirs only — NOT the pcf/ folder itself; source files (index.ts, ControlManifest.Input.xml, package.json, pcfconfig.json, etc.) stay tracked: pcf/**/{out,Solutions,node_modules,obj,bin,generated}/
  • Test-harness artifacts: test-harness/*.msapp
  • Skill-generated backups: *.bak.* (skills that replace tracked content may save a timestamped backup; those are intentionally local-only)
  • Design-time previews: .pcf-preview/ (HTML mockup of the PCF as it appears in Canvas Studio — written by /design-native-extension-feature Step 8.0 for visual review; regenerated each design iteration; not a source-of-truth artifact)

• package.json — per the dev-only shape in shared/repo-layout.md §"package.json shape (dev-only)". Fill in name (a plain local name, e.g. <kebab>-control) and description from the PRD. version starts at 0.1.0. Set "private": true.

  This manifest is never published — no publishConfig, no feed registry, no files array, no main/types, no .npmrc. Its only job is to pin the React Native version the native builds compile against:

  Copy

  {
    "name": "<kebab>-control",
    "version": "0.1.0",
    "private": true,
    "description": "<from PRD §1>",
    "devDependencies": {
      "react": "18.2.0",
      "react-native": "0.79.7"
    }
  }

  The react-native devDep supplies the iOS headers (/build-ios-binary) and pins the react-android coordinate the Android build resolves (/build-android-binary); add any other build-time devDeps the native modules need. All deps resolve from the public npm registry — there is no internal feed.

• manifest.json (repo root, committed — the dispatch-contract source of truth) — author it now from the names this scaffold emits, per shared/ppmplugin-format.md §2 (schema) + §3 (derivation). This is the single artifact the Companion PCF (/generate-pcf-companion) and the build stage (/generate-ppmplugin-manifest) both read; authoring it here, next to the native code it describes, is what keeps the composite key <name>/<receiver> from drifting between the PCF and the module. Fields:

  • name = kebab(<Pascal>) of the class name (not the repo/capability name) — e.g. class PenInput → pen-input.
  • version = the package.json version (0.1.0).
  • abi = { "compatibleShells": ">=1.0.0", "builtAgainst": "1.0.0" } (default; the build skills don't change it).
  • receivers[] = a single entry { "name": "<Pascal>Extension", "nativeModule": "<Pascal>Module", "methods": [<every @ReactMethod / RCT_EXPORT_METHOD name emitted in §3.4 / §3.5>] }. nativeModule MUST equal Android getName() and the iOS +moduleName return value — the Module-suffixed name (the reserved-name dodge).
  • entrypoints = declare every platform this scaffold generated (so the committed manifest is the full contract; the build stage trims it to the shipped target):
    • Android → "android": { "dex": "<Pascal>Plugin.dex", "packageClass": "com.powerapps.<lower>.<Pascal>Package" }
    • iOS → "ios": { "framework": "<Pascal>Plugin", "moduleClass": "RCT<Pascal>Module" }

  This is a logical contract, not a built artifact — it lists the platforms the module supports; the per-platform binaries are compiled later and the staged copy under ppmplugin/staging/ is reconciled down to whatever actually ships. Do NOT emit any entrypoints.js / extension.hbc / extensionClassName / jsLayer field — those are SDK-era leakage /audit-ppmplugin rejects. (The build stage re-runs the full validator on this file, so a malformed manifest is caught either way — but emit it correctly here.)

• README.md — one-page user-facing doc tailored to the control. Sections: "What's in the box" (the compiled .ppmplugin bundle + PCF companion), "Build" (run /generate-ppmplugin to produce the .ppmplugin), "Architecture" (a Mermaid-or-ASCII diagram of Canvas formula → PCF → wrap-bridge → NativeModules.<Pascal>Module), "Development" (pnpm install to seed devDeps; native code is compiled by the build skills, not here), "Reference docs" (link to shared/ppmplugin-format.md). Use the PRD's §1 Summary verbatim. Drive every section from the PRD — never inject example values, prose, or screenshots from any other control's README.

• CHANGELOG.md — single entry:

  Copy

  # Changelog
  
  ## 0.1.0 — <ISO date>
  
  - Initial scaffold for <Human-Readable Name> native control.
  - Generated by pam-native-extensions plugin from PRD.md.

• LICENSE — MIT.

Write <Pascal>Extension.podspec at the repo root (NOT inside ios/) only if ARCHITECTURE §1.2 names additional iOS system frameworks the module links. The .ppmplugin iOS build (/build-ios-binary) compiles from a throwaway staged Xcode project and does NOT npm-autolink against this podspec — so it lists system frameworks only (no React-Core / RN-CLI autolink dependency, no remote source). It exists for local pod lib lint convenience, not the bundle build. Template:

require "json"

package_json = JSON.parse(File.read(File.join(__dir__, "package.json")))

Pod::Spec.new do |s|
  s.name         = "<Pascal>Extension"
  s.version      = package_json["version"]
  s.summary      = "<one-line description from PRD>"
  s.description  = <<-DESC
    <2-3 sentence description from PRD — what it does, what it bridges to>
  DESC
  s.license      = "MIT"
  s.author       = { "Author" => "" }
  s.platform     = :ios, "<min-deployment-target from ARCHITECTURE §1.2>"
  s.source       = { :path => "." }
  s.source_files = "ios/**/*.{h,m}"   # change to {h,m,swift} if Swift used
  s.frameworks   = <comma-quoted list of SYSTEM frameworks from ARCHITECTURE §1.2>
  # No React-Core dependency: the .ppmplugin build resolves RN headers from the
  # react-native devDep in package.json, not via CocoaPods autolinking.
end

This is the native-only track: there is no src/ TypeScript layer, no src/<Pascal>Extension.ts, no src/types.ts, no INativeExtension / handleMessageAsync implementation, and no sendAsync transport. (Those belong to the first-party SDK track — NOT in this track.) Do NOT generate any of them; reintroducing a TS contract layer here produces SDK-era leakage that /audit-ppmplugin rejects.

The contract instead is the manifest's runtime dispatch (shared/ppmplugin-format.md §2): the wrap host routes a call by the composite key <name>/<receiver> straight to NativeModules.<Pascal>Module.<method>(args, promise). There is no JS mediator. This means:

• The request shape (the args object) and response shape (the object the promise resolves with) from ARCHITECTURE §4 are realized directly in the native @ReactMethod / RCT_EXPORT_METHOD signatures + their JSON responses — see §3.4 (iOS) and §3.5 (Android). The per-operation JSON parsing, request validation, operation branching, and error-code responses that a first-party TS handleMessageAsync would have done are emitted inside each native method instead. That dispatch logic is the valuable part this skill generates.
• The manifest.json that declares name, receivers[].method, and receivers[].nativeModule (= <Pascal>Module) is written by this skill at the repo root (§3.1) — the native module symbols it emits and the manifest's receivers[] are authored together, so they can't disagree. /generate-ppmplugin-manifest later validates + reconciles + stages this file rather than re-authoring it (§2/§3 below + shared/ppmplugin-format.md §3).
• The error-code set from ARCHITECTURE §5 is realized as the string codes the native errorJson(code, message) helpers emit (§3.4 / §3.5), each paired with a human-readable message — there is no TS error-union type to declare. These codes are the stable strings from the canonical catalog shared/error-codes.md (Canvas formulas branch on them, so they must not drift); emit exactly the catalog spelling for any code ARCHITECTURE §5 reuses. The PCF reads both: the error code to branch on, the message to surface as its ErrorMessage output.

Write:

• ios/RCT<Pascal>Module.h — minimal Obj-C header importing <React/RCTBridgeModule.h>, declaring @interface RCT<Pascal>Module : NSObject <RCTBridgeModule> @end.

• ios/RCT<Pascal>Module.m — the implementation. Generate complete working code, not TODO placeholders. For each operation in PRD §4, the per-operation §3.<n> block prescribes every implementation decision (framework, hosting, key APIs, export shape, edge case handling). Generate the implementation verbatim from §3.<n>:

  • Imports: include RCT<Pascal>Module.h, UIKit, plus every framework named in ARCHITECTURE §3.<n>'s "Framework / class" field for any operation (e.g. #import <PencilKit/PencilKit.h> if any §3.<n> names PencilKit).
  • Module identity: do NOT emit RCT_EXPORT_MODULE(...) in a wrap plugin framework. That macro registers via +load and _RCTRegisterModule, which is not visible to the framework's dlopen flat namespace. Instead emit a class method + (NSString *)moduleName { return @"<Pascal>Module"; } — the Module-suffixed name. The Obj-C class name stays RCT<Pascal>Module (matching entrypoints.ios.moduleClass), while +moduleName MUST equal the manifest's receivers[].nativeModule and JS sees NativeModules.<Pascal>Module. Do NOT strip the suffix.
  • + (BOOL)requiresMainQueueSetup returning NO unless any §3.<n> requires main-thread init.
  • init safety — the module is instantiated eagerly at load via [cls new], so init MUST NOT throw or do heavy/side-effecting work (ppmplugin-format §5). Do not acquire hardware, register NSNotification/KVO observers, or touch AVCaptureSession/CLLocationManager in init — defer to the first RCT_EXPORT_METHOD call (lazy), and wrap any unavoidable init work in @try/@catch. An uncaught exception in init crashes the host at launch (the iOS analogue of the Android Looper-less-Handler crash).
  • For each operation, write an RCT_EXPORT_METHOD taking exactly one NSDictionary *request parameter, then RCTPromiseResolveBlock resolve, RCTPromiseRejectBlock reject — e.g. RCT_EXPORT_METHOD(capturePenInput:(NSDictionary *)request resolver:(RCTPromiseResolveBlock)resolve rejecter:(RCTPromiseRejectBlock)reject). This matches the wrap dispatch contract: the PCF sends args: [request] (a one-element array) spread positionally, so the method's first positional param is the request dictionary (ppmplugin-format §2). Read fields off request (request[@"…"]); do NOT expand into multiple positional params. Also: the Obj-C class MUST instantiate via a no-arg [cls new] after the runtime loads it — don't add a custom designated initializer that takes arguments. The body implements §3.<n>'s iOS spec completely:
    • The hosting setup ("dedicated UIViewController presented modally, full-screen" → emit a UIViewController subclass or inline VC + presentViewController:animated:completion:). The presented VC's viewDidLoad MUST constrain custom content views to view.safeAreaLayoutGuide, not view directly — this prevents content from intruding under the notch / Dynamic Island / home indicator. Set modalPresentationStyle = UIModalPresentationFullScreen (or .pageSheet per ARCHITECTURE §3.<n>). Add a UINavigationBar with Done / Cancel UIBarButtonItems for clear action affordance — same Material-toolbar-equivalent pattern as Android.
    • The key API calls in the order §3.<n> specifies (e.g. PKCanvasView init, PKToolPicker attachment, drawing capture)
    • Each Done/Cancel/dismiss handler as §3.<n> specifies
    • The export step as §3.<n>'s "Export" line specifies (e.g. drawing.image(from: canvas.bounds, scale: 2.0) → PNG → base64)
    • Each edge case from §3.<n>'s "Edge cases handled" list, with the exact behavior named (e.g. "User taps Cancel → resolve with USER_CANCELLED")
  • Threading: background work on dispatch_get_global_queue; UI presentation on dispatch_get_main_queue. Long-running native work must not block the JS thread.
  • Error helper: emit - (NSString *)errorJsonWithCode:(NSString *)code message:(NSString *)message that builds the dict @{@"status": @"error", @"error": code, @"message": (message ?: @"")} and serializes it via NSJSONSerialization — the SAME serializer as the success helper. Do NOT use stringWithFormat: a message (or code) containing a ", \, or newline would emit invalid JSON, which the PCF's response parse would surface as a misleading PARSE instead of the real failure — defeating the whole point of the message. The message is a human-readable diagnostic that makes the failure debuggable from the PCF without a native debugger: for a caught exception pass error.localizedDescription; for a validation failure a specific reason (e.g. @"missing required field 'uri'"); for USER_CANCELLED a short note. Every error path calls this with BOTH a code and a message — never a bare code.
  • Success helper: emit - (NSString *)successJsonWith:(NSDictionary *)result that builds {"status":"ok","result":<result>} via NSJSONSerialization.
  • Error propagation — wrap the operation body so every failure reaches the PCF with a code AND a message. Any framework/runtime failure must resolve with errorJsonWithCode:message: carrying a specific code and reason — never throw an uncaught Obj-C exception, crash, or resolve empty. Use @try/@catch around risky synchronous work and resolve the @catch with INTERNAL_ERROR plus exception.reason.
  • UI hygiene boilerplate for each presented UIViewController's viewDidLoad (mirrors Android's insets handling — prevents the most common iOS issue: content under safe areas, status bar, home indicator):
    Copy

    - (void)viewDidLoad {
        [super viewDidLoad];
        self.view.backgroundColor = [UIColor systemBackgroundColor];
    
        // Navigation bar with Done / Cancel — equivalent to Android's MaterialToolbar.
        UINavigationBar *navBar = [[UINavigationBar alloc] init];
        navBar.translatesAutoresizingMaskIntoConstraints = NO;
        UINavigationItem *navItem = [[UINavigationItem alloc] initWithTitle:@"<Human-readable from PRD §2>"];
        navItem.leftBarButtonItem = [[UIBarButtonItem alloc]
            initWithBarButtonSystemItem:UIBarButtonSystemItemCancel
            target:self action:@selector(handleCancel)];
        navItem.rightBarButtonItem = [[UIBarButtonItem alloc]
            initWithBarButtonSystemItem:UIBarButtonSystemItemDone
            target:self action:@selector(handleDone)];
        navBar.items = @[navItem];
        [self.view addSubview:navBar];
    
        // Content view — the operation-specific surface (e.g. PKCanvasView, AVCaptureVideoPreviewLayer host).
        // Constrain to safeAreaLayoutGuide so content doesn't extend under the notch / home indicator.
        UIView *contentView = [[UIView alloc] init];   // Replace with operation-specific view per ARCHITECTURE §3.<n>
        contentView.translatesAutoresizingMaskIntoConstraints = NO;
        [self.view addSubview:contentView];
    
        [NSLayoutConstraint activateConstraints:@[
            [navBar.topAnchor constraintEqualToAnchor:self.view.safeAreaLayoutGuide.topAnchor],
            [navBar.leadingAnchor constraintEqualToAnchor:self.view.leadingAnchor],
            [navBar.trailingAnchor constraintEqualToAnchor:self.view.trailingAnchor],
            [contentView.topAnchor constraintEqualToAnchor:navBar.bottomAnchor],
            [contentView.leadingAnchor constraintEqualToAnchor:self.view.safeAreaLayoutGuide.leadingAnchor],
            [contentView.trailingAnchor constraintEqualToAnchor:self.view.safeAreaLayoutGuide.trailingAnchor],
            [contentView.bottomAnchor constraintEqualToAnchor:self.view.safeAreaLayoutGuide.bottomAnchor],
        ]];
    }
    
    - (UIStatusBarStyle)preferredStatusBarStyle {
        // Adapt to system appearance — matches Android's windowLightStatusBar in light theme.
        return UIStatusBarStyleDefault;   // automatic light/dark per system
    }

  • Modal helper: emit - (UIViewController *)topViewController if any operation presents modally:
    Copy

    - (UIViewController *)topViewController {
        UIViewController *root = UIApplication.sharedApplication.keyWindow.rootViewController;
        while (root.presentedViewController) { root = root.presentedViewController; }
        return root;
    }

  No TODO placeholders. No // implement this. If a §3.<n> block is incomplete (any "Key APIs and decisions" item is vague or missing), STOP with NEEDS_CONTEXT: ARCHITECTURE §3.<n> implementation block is incomplete — re-run /design-native-extension-feature Step 7 (per-operation implementation walkthrough) to complete it. Don't paper over a vague spec with a guess.

Write:

• android/build.gradle — library-only gradle config. The module is consumed by the host's managed build, which provides the root project setup. (For the standalone .ppmplugin build, /build-android-binary compiles from a throwaway staged copy with pinned versions — this canonical file is never edited; see shared/ppmplugin-format.md §5.) Do NOT emit a buildscript { ... }, allprojects { ... }, or any classpath declarations — those belong to the root project, not this library module.

  Library-only shape (this is the entire file — no preamble, no root-project blocks):

  Copy

  // <kebab>-control
  // Android library module — consumed by the host's managed build.
  
  apply plugin: 'com.android.library'
  apply plugin: 'kotlin-android'
  
  def safeExtGet(prop, fallback) {
      rootProject.ext.has(prop) ? rootProject.ext.get(prop) : fallback
  }
  
  android {
      namespace "com.powerapps.<lower>"
      compileSdkVersion safeExtGet('compileSdkVersion', 35)
      defaultConfig {
          minSdkVersion safeExtGet('minSdkVersion', <PRD min — default 24>)
          targetSdkVersion 35
      }
      compileOptions {
          sourceCompatibility JavaVersion.VERSION_17
          targetCompatibility JavaVersion.VERSION_17
      }
      kotlinOptions { jvmTarget = '17' }
  }
  
  dependencies {
      // 'react-android' (renamed from 'react-native' in RN 0.73). compileOnly + pinned:
      // the wrap shell provides RN at runtime, so never bundle it, and the legacy
      // 'react-native:+' coordinate does not resolve in the standalone build.
      // Read <rnVersion> from package.json devDependencies (currently 0.79.7).
      compileOnly "com.facebook.react:react-android:<rnVersion>"
      implementation 'androidx.appcompat:appcompat:1.6.1'
      implementation 'androidx.core:core-ktx:1.12.0'                  // WindowCompat / WindowInsetsCompat for UI hygiene
      implementation 'androidx.constraintlayout:constraintlayout:2.1.4' // for the generated layout XML
      implementation 'com.google.android.material:material:1.11.0'    // Material 3 theme + components
      // Plus any ARCHITECTURE §1.3 / §1.4-specified additions (e.g. ML Kit, FusedLocationProvider)
  }

• Files NOT to generate (these are root-project / standalone-build concerns; the host's managed build — or, for the .ppmplugin, /build-android-binary's staged copy — owns them):

  • android/settings.gradle — root project's responsibility
  • android/gradle.properties — root project's properties; android.useAndroidX and android.enableJetifier are supplied ambiently by the host (and generated into the staged copy by /build-android-binary), not by the library
  • android/gradlew + android/gradle/wrapper/* — the Gradle wrapper; library modules don't need their own wrapper
  • Any top-level buildscript { ext, repositories, dependencies (classpath) } block in build.gradle — the host provides AGP + Kotlin classpaths

  No standalone build script. The android/ directory is consumed by the host's managed build (and copied into a pinned staging dir by /build-android-binary for the .ppmplugin); it doesn't have to compile in isolation. Don't add a top-level buildscript { ... } / allprojects { ... } block — the host provides those. Standalone ./gradlew assembleDebug against this directory is not a validation path we support (native compile happens in /build-android-binary, not here — see shared/ppmplugin-format.md §5).

• android/src/main/AndroidManifest.xml — registers permissions from ARCHITECTURE §1.4 AND the dedicated capture Activity (if ARCHITECTURE §3.<n> hosts in one) with a Material 3 theme:

  Copy

  <manifest xmlns:android="http://schemas.android.com/apk/res/android" package="com.powerapps.<lower>">
      <!-- One <uses-permission android:name="..." /> per entry in ARCHITECTURE §1.4 Android permissions -->
  
      <application>
          <!-- One <activity> per ARCHITECTURE §3.<n> that hosts in a dedicated Activity.
               Theme references generated themes.xml; screenOrientation per ARCHITECTURE §3.<n>. -->
          <activity
              android:name=".<Pascal>CaptureActivity"
              android:theme="@style/Theme.<Pascal>"
              android:screenOrientation="portrait"
              android:exported="false" />
      </application>
  </manifest>

• android/src/main/res/values/themes.xml — Material 3 theme so all components render with proper Material styling, not the bare AppCompat defaults. Without this, generated UIs hit issues like status bar overlap and unthemed buttons.

  Copy

  <?xml version="1.0" encoding="utf-8"?>
  <resources xmlns:tools="http://schemas.android.com/tools">
      <style name="Theme.<Pascal>" parent="Theme.Material3.DayNight.NoActionBar">
          <!-- System bars: drawn by the OS but content extends behind them; the Activity applies insets. -->
          <item name="android:statusBarColor">@android:color/transparent</item>
          <item name="android:navigationBarColor">@android:color/transparent</item>
          <item name="android:windowLightStatusBar" tools:targetApi="m">true</item>
          <item name="android:windowLightNavigationBar" tools:targetApi="o_mr1">true</item>
      </style>
  </resources>

• android/src/main/res/layout/activity_<lower>_capture.xml — root layout uses Material components. Toolbar at top, bounded content area in a MaterialCardView (drawing surface, camera preview, etc.):

  Copy

  <?xml version="1.0" encoding="utf-8"?>
  <androidx.constraintlayout.widget.ConstraintLayout
      xmlns:android="http://schemas.android.com/apk/res/android"
      xmlns:app="http://schemas.android.com/apk/res/auto"
      android:id="@+id/root"
      android:layout_width="match_parent"
      android:layout_height="match_parent"
      android:background="?attr/colorSurface">
  
      <com.google.android.material.appbar.MaterialToolbar
          android:id="@+id/toolbar"
          android:layout_width="match_parent"
          android:layout_height="?attr/actionBarSize"
          android:elevation="4dp"
          app:layout_constraintTop_toTopOf="parent"
          app:menu="@menu/<lower>_capture_menu"
          app:navigationIcon="@drawable/ic_close"
          app:title="<Human-readable name from PRD §2>" />
  
      <com.google.android.material.card.MaterialCardView
          android:id="@+id/content_card"
          android:layout_width="0dp"
          android:layout_height="0dp"
          android:layout_margin="16dp"
          app:cardCornerRadius="8dp"
          app:cardElevation="2dp"
          app:layout_constraintTop_toBottomOf="@id/toolbar"
          app:layout_constraintBottom_toBottomOf="parent"
          app:layout_constraintStart_toStartOf="parent"
          app:layout_constraintEnd_toEndOf="parent">
  
          <!-- The operation-specific surface goes here: drawing View, camera SurfaceView,
               photo preview, etc. — substituted per ARCHITECTURE §3.<n>'s "Hosting" specification. -->
          <View
              android:id="@+id/capture_surface"
              android:layout_width="match_parent"
              android:layout_height="match_parent"
              android:background="?attr/colorSurfaceContainerLowest" />
      </com.google.android.material.card.MaterialCardView>
  </androidx.constraintlayout.widget.ConstraintLayout>

• android/src/main/res/menu/<lower>_capture_menu.xml — toolbar action items. action_done is MANDATORY for any capture-flow operation; without it the user has no way to submit. Additional actions (Clear, Undo, etc.) per ARCHITECTURE §3.<n>'s UI actions:

  Copy

  <menu xmlns:android="http://schemas.android.com/apk/res/android"
        xmlns:app="http://schemas.android.com/apk/res/auto">
      <!-- MANDATORY for capture flows. NEVER omit Done — user cannot complete the operation otherwise. -->
      <item
          android:id="@+id/action_done"
          android:title="@string/action_done"
          app:showAsAction="always" />
  
      <!-- Optional: one <item> per additional toolbar action declared in ARCHITECTURE §3.<n>
           (e.g. Clear All, Undo). Set app:showAsAction="ifRoom" for non-critical actions. -->
  </menu>

• For multi-mode capture operations (pen/eraser, photo/video, etc.): the toolbar / mode-selection row uses MaterialButtonToggleGroup, not plain Buttons. Toggle group provides the active-state visual feedback the user needs to know which mode is currently selected. Example layout fragment to include in activity_<lower>_capture.xml:

  Copy

  <!-- Insert into the toolbar or just below it, when ARCHITECTURE §3.<n> has multiple modes. -->
  <com.google.android.material.button.MaterialButtonToggleGroup
      android:id="@+id/mode_toggle_group"
      android:layout_width="wrap_content"
      android:layout_height="wrap_content"
      app:singleSelection="true"
      app:selectionRequired="true">
  
      <!-- One <Button style="?attr/materialButtonOutlinedStyle"> per mode in ARCHITECTURE §3.<n>.
           Example for pen/eraser/clear: -->
      <Button android:id="@+id/mode_pen"     android:text="@string/mode_pen"     style="?attr/materialButtonOutlinedStyle" />
      <Button android:id="@+id/mode_eraser"  android:text="@string/mode_eraser"  style="?attr/materialButtonOutlinedStyle" />
  </com.google.android.material.button.MaterialButtonToggleGroup>

  And wire the listener in the Activity's onCreate:

  Copy

  val toggleGroup: MaterialButtonToggleGroup = findViewById(R.id.mode_toggle_group)
  toggleGroup.check(R.id.mode_pen)   // default
  toggleGroup.addOnButtonCheckedListener { _, checkedId, isChecked ->
      if (!isChecked) return@addOnButtonCheckedListener
      when (checkedId) {
          R.id.mode_pen -> captureSurface.setMode(<Pascal>Mode.PEN)
          R.id.mode_eraser -> captureSurface.setMode(<Pascal>Mode.ERASER)
      }
  }

  Without this, the user sees a row of identical-looking buttons and has no idea which mode is active. Confirmed UX-blocking failure mode in v0 extensions.

• android/src/main/res/values/strings.xml — string resources for the menu items + content descriptions (accessibility):

  Copy

  <resources>
      <string name="action_done">Done</string>
      <!-- Plus one entry per ARCHITECTURE §3.<n> action; one content-description per accessible element. -->
  </resources>

• android/src/main/java/com/powerapps/<lower>/<Pascal>Module.kt — Kotlin native module. Generate complete working code, not TODO placeholders. For each operation, the per-operation §3.<n> block's "Android implementation" sub-section prescribes every implementation decision. Generate the implementation verbatim from §3.<n>:

  • Class: extends ReactContextBaseJavaModule.
  • getName() returns "<Pascal>Module" — the Module-suffixed name (matches NativeModules.<Pascal>Module on JS side, the iOS +moduleName return value, and the manifest's receivers[].nativeModule). Do NOT strip the suffix — it's the reserved-name dodge (see shared/ppmplugin-format.md §4).
  • For each operation, write a @ReactMethod function taking exactly one ReadableMap request parameter followed by Promise promise — e.g. @ReactMethod fun capturePenInput(request: ReadableMap, promise: Promise). This matches the wrap dispatch contract: the PCF sends args: [request] (a one-element array) and the proxy does fn.apply(mod, [request]), so the method receives the request object as its single positional param (ppmplugin-format §2). Read each field off request (request.getString("…"), request.getInt("…"), etc.); do NOT expand the request into multiple positional params. The body implements §3.<n>'s Android spec completely:
    • The hosting (dedicated Activity via Intent, or Fragment, or in-place — whatever §3.<n> specifies)
    • The key API calls in the order §3.<n> specifies (e.g. View.onTouchEvent registration; Path accumulation; stylus pressure handling)
    • Each Done/Cancel handler as §3.<n> specifies
    • The export step as §3.<n>'s "Export" line specifies (e.g. render to Bitmap, compress to PNG, base64-encode)
    • Each edge case from §3.<n>'s "Edge cases handled" list, with the exact behavior named
  • If §3.<n> requires a dedicated Activity, emit it as a separate .kt file under the same package (e.g. <Pascal>CaptureActivity.kt) and register it in AndroidManifest.xml. The Activity's onCreate MUST emit the following UI hygiene boilerplate so the generated UI doesn't suffer from status bar overlap, missing Material theming, or rotation issues (these were repeat issues in v0 extensions):
    Copy

    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)
        // Edge-to-edge layout; we apply system-bar padding ourselves below.
        WindowCompat.setDecorFitsSystemWindows(window, false)
        setContentView(R.layout.activity_<lower>_capture)
    
        // Pad root by status/nav bar insets so toolbar doesn't sit UNDER the status bar.
        // This is the fix for the most common Android UI bug in PAM extensions:
        // "buttons overlapping with system clock / status icons".
        ViewCompat.setOnApplyWindowInsetsListener(findViewById(R.id.root)) { v, insets ->
            val bars = insets.getInsets(WindowInsetsCompat.Type.systemBars())
            v.setPadding(bars.left, bars.top, bars.right, bars.bottom)
            WindowInsetsCompat.CONSUMED
        }
    
        // Toolbar with Done/Cancel via Material menu.
        val toolbar: MaterialToolbar = findViewById(R.id.toolbar)
        setSupportActionBar(toolbar)
        toolbar.setNavigationOnClickListener { onCancelled() }   // navigation icon = Cancel
    
        // Wire up the operation-specific surface (drawing View, camera preview, etc.)
        // — per ARCHITECTURE §3.<n>'s "Hosting" + "Key APIs and decisions" specification.
        val captureSurface: <PRD-§3.<n>-View-class> = findViewById(R.id.capture_surface)
        // ... operation-specific setup per §3.<n> ...
    }
    
    override fun onCreateOptionsMenu(menu: Menu): Boolean {
        menuInflater.inflate(R.menu.<lower>_capture_menu, menu)
        return true
    }
    
    override fun onOptionsItemSelected(item: MenuItem): Boolean {
        return when (item.itemId) {
            R.id.action_done -> { onDone(); true }
            // Plus one branch per additional toolbar action declared in §3.<n>.
            else -> super.onOptionsItemSelected(item)
        }
    }

    Required imports: androidx.core.view.WindowCompat, androidx.core.view.ViewCompat, androidx.core.view.WindowInsetsCompat, com.google.android.material.appbar.MaterialToolbar.
  • Constructor / init{} safety — the module is built eagerly at bridge startup on a possibly Looper-less thread, so construction MUST NOT throw (ppmplugin-format §5). Keep the constructor cheap: do NOT register system callbacks, acquire camera/sensor/location managers, or do file I/O in the constructor / init{} — defer them to the first @ReactMethod call (lazy init). If a listener genuinely must be registered at construction, pass an explicit Handler(Looper.getMainLooper()) — never null (a null or implicit Looper throws Can't create handler inside thread that has not called Looper.prepare()), and wrap it in try/catch so a subsystem hiccup leaves the module in a safe default state instead of crashing the host at launch. Example: private val mainHandler = Handler(Looper.getMainLooper()), then try { cameraManager?.registerTorchCallback(cb, mainHandler) } catch (e: Exception) { /* best-effort */ }. Mirror the same discipline in invalidate() (unregister in try/catch).
  • Runtime permissions (dangerous perms only). For any op whose ARCHITECTURE §1.4 lists a dangerous Android permission (CAMERA, RECORD_AUDIO, ACCESS_FINE/COARSE_LOCATION, …), the @ReactMethod MUST check ContextCompat.checkSelfPermission(...) before calling the API and, if not granted, promise.resolve(errorJson("PERMISSION_DENIED", "<permission> not granted")) (a declared §5 code) rather than let the framework throw SecurityException. Declaring it in AndroidManifest.xml is necessary but not sufficient — API 23+ requires the runtime grant.
  • currentActivity nullability. Any method that presents UI / starts an Activity MUST guard val activity = currentActivity ?: return promise.resolve(errorJson("NO_ACTIVITY", "no foreground activity")) — currentActivity is null when the app is backgrounded, and dereferencing it NPE-crashes the host.
  • Threading: heavy work in a coroutine (CoroutineScope(Dispatchers.IO).launch { ... }) or Thread { ... }.start(); UI work back via Handler(Looper.getMainLooper()).post { ... } or withContext(Dispatchers.Main).
  • Response JSON: must mirror iOS exactly. Both platforms must produce byte-identical JSON for the same input — this is non-negotiable, scaffold MUST verify by visual inspection of the two implementations after writing them.
  • Helper private fun errorJson(code: String, message: String): String building {"status":"error","error":"<code>","message":"<message>"} via JSONObject (the same serializer as successJson — JSONObject().put("status","error").put("error",code).put("message",message).toString()). Do NOT build it with string interpolation: a message containing a ", \, or newline would emit invalid JSON, which the PCF's response parse would surface as a misleading PARSE instead of the real failure. The message is a human-readable diagnostic: for a caught exception pass e.message ?: e.toString(); for a validation failure a specific reason; for USER_CANCELLED a short note. This MUST mirror iOS byte-for-byte. Every error path calls this with BOTH a code and a message.
  • Helper private fun successJson(result: Map<String, Any?>): String building {"status":"ok","result":<json>} via JSONObject.
  • Error propagation — every failure resolves the Promise with errorJson(code, message), never a thrown/uncaught exception. Wrap the operation body (and any coroutine/Thread) in try/catch; on catch, promise.resolve(errorJson("INTERNAL_ERROR", e.message ?: e.toString())). A coroutine that throws without catching, or a path that never resolves the Promise, leaves the maker with a hung control and no code/message.

  No TODO placeholders. If a §3.<n> block is incomplete, STOP with the same NEEDS_CONTEXT: error as iOS — don't write Android code from a vague spec.

• android/src/main/java/com/powerapps/<lower>/<Pascal>Package.kt — ReactPackage implementation that registers <Pascal>Module. It MUST have a public no-arg constructor — the wrap runtime instantiates it via loadClass(packageClass).getDeclaredConstructor().newInstance(), so a ReactPackage with only an arg-ed constructor throws NoSuchMethodException and the plugin silently fails to load (ppmplugin-format §5). The form below is correct — Kotlin gives class <Pascal>Package : ReactPackage an implicit no-arg constructor. Do NOT add a constructor with parameters to the package class (the module takes reactContext via createNativeModules — that's fine; the package must stay no-arg):

  Copy

  class <Pascal>Package : ReactPackage {   // no-arg constructor required by the wrap runtime
      override fun createNativeModules(reactContext: ReactApplicationContext) =
          listOf<NativeModule>(<Pascal>Module(reactContext))
      override fun createViewManagers(reactContext: ReactApplicationContext) =
          emptyList<ViewManager<*, *>>()
  }

There is no tests/ directory to write. The first-party SDK track validates conformance with TypeScript type-level fixtures (*.test-d.ts + tsc --noEmit) against the INativeExtension interface — but that layer does not exist here (§3.3), so there is nothing to type-check.

The third-party-control analogue is structural contract verification done by /test-native-extension, not generated source: it greps the native modules' request/response/error usage against each other and against the manifest (the Android getName() ↔ iOS +moduleName ↔ receivers[].nativeModule agreement, the cross-platform JSON parity). That runs as a separate skill on the working tree — this skill does not emit test files for it. No Jest, no tsconfig, no fixtures.

Write .extension-state.md using the template in shared/repo-layout.md §".extension-state.md template". Fill:

• Identity block — from PRD §2 plus the derived names (Capability, Class, Native module = <Pascal>Module, Android package, PRD path).
• Phase: Last completed: scaffold / Next: /test-native-extension / Status: ok.
• ## ppmplugin (third-party controls) block — leave at its defaults (Target: unset, Manifest: not written, Android DEX: not built, iOS framework: not built, Bundle: not assembled). The /generate-ppmplugin build skills fill it.

If a .extension-state.md already existed and we agreed to "resume" in Step 1.7, only update the Phase block (leave ## ppmplugin untouched — it captures any later build state).

Fresh-read from disk. Files of interest:

• android/src/main/java/com/powerapps/<lower>/<Pascal>Module.kt (its @ReactMethod request/response/error surface — this IS the dispatch contract, since there is no TS layer)
• android/src/main/java/com/powerapps/<lower>/<Pascal>CaptureActivity.kt and any other Activities
• android/src/main/res/**/*.xml (layouts, menus, themes, manifest)
• ios/RCT<Pascal>Module.{h,m} (or .swift if ARCHITECTURE §1.2 chose Swift)
• ios/*.podspec
• pcf/<Pascal>PCF/index.ts and ControlManifest.Input.xml (if PCF was part of this run)

For each gate in the protocol — PRD coverage, User journey, Layout feasibility, State coverage, Cross-platform parity, Reversibility, Asymptotic / lifecycle, Spec-drift, Runtime safety & lifecycle, Buildability & bundle-fit feasibility, PCF ↔ native round-trip contract — execute the gate's "enumerate + ask" procedure as described in the protocol file.

Gate 10 (Buildability) is not optional for this track. It re-runs, over the generated code, the same reasoning /design-native-extension-feature Step 7.5 ran over the design — so a dependency, return shape, or construction cost that slipped past design (or was introduced during codegen) is caught here, before /build-android-binary / /build-ios-binary fail minutes later. Gate 11 (PCF round-trip) runs only when a PCF was emitted in this run; when the PCF is generated separately, /generate-pcf-companion Step 5.7 runs it instead.

Do not short-circuit. Each gate enumerates real items (PRD bullet points, user-reachable controls, horizontal container children, etc.) and answers a concrete question per item. Skipping a gate because "intuitively the code looks fine" defeats the purpose — the whole point is to force structured analysis where past intuition has failed.

Aggregate findings across all gates. Each finding follows the protocol's structure:

- Gate: <name>
- File: <path>:<line range>
- Severity: blocker | concern
- Problem: <one sentence>
- Why this is wrong: <one sentence anchored in the gate's principle>
- Suggested fix: <what to change>
- Autofix: applied | proposed | requires human review

For generation context (this skill), the user has no intermediate review checkpoint between code-emit and Step 4 smoke check. The protocol's auto-fix policy translates to:

• autofix: applied (mechanical fix, no design choice) → apply silently, log to .extension-state.md under Auto-fixes.
• autofix: proposed (structural fix, unambiguous) → apply, surface in the final summary with a one-line note. The user can read .extension-state.md to see the diff against their expected output.
• autofix: requires human review (design judgment) → do NOT modify code. Promote to a top-level NEEDS_CONTEXT item in the final summary.

(Contrast with /debug-extension Step 7.5, which gates proposed fixes on explicit user confirm because it sits inside an interactive review cadence.)

If 3.8.4 applied any fixes, repeat from 3.8.1. A fix at one gate can either unblock or surface a new finding elsewhere. Cap the loop at 3 iterations; if findings remain after iteration 3, surface them as concerns regardless of severity.

• All gates clean OR fixed → continue to Step 4. Run can return DONE.
• Concerns remain (acceptable per gate severity rules) → run returns DONE_WITH_CONCERNS: <one-line summary>. Log every concern in .extension-state.md.
• Any blocker remains → run returns BLOCKED: self-critique found <list>. Surface the report. The scaffold is not shippable until the user resolves blockers.

The protocol's gates are derived from first principles, not from a list of past failures. By construction, it should catch:

When a new failure mode is observed, the question to ask is "which gate should have caught this?" If the answer is "none of them" — that's a signal the protocol needs a new gate (or an existing gate's enumeration list needs expanding). Do NOT add a one-off pattern check that doesn't generalize.

This step is LLM reasoning over generated source. It is not a real compiler. The protocol is structured enough to force enumeration (and stop "looks fine" from being a valid answer), but it depends on the reasoning at each gate actually being careful. Pair with /build-android-binary / /build-ios-binary (real compile) and on-device verification for runtime errors the protocol can't simulate.